A quick guide to staying “cloud compliant” with new HIPAA rules

In March, the Health Insurance Portability and Accountability Act (HIPAA) Omnibus Final Rule (PDF) went into effect. For most companies (there are a few exceptions) to stay in compliance, they must fulfill those rules by Sept. 23.

As reported on InsideCounsel last week, the updates expand the definition of “business associates,” who must follow the same guidelines as physicians and insurance providers. The new rules specifically address cloud providers, reading, “Document storage companies maintaining protected health information on behalf of covered entities are considered business associates, regardless of whether they actually view the information they hold.”

Business associates and subcontractors should state in a signed agreement or contract that they and any of their subcontractors are HIPAA compliant. “As a business associate they must meet the compliance rules for all privacy and security requirements,” author Gilad Parann-Nissany, CEO of Porticor, said in his post on Sys-Con.

2. Have a data backup contingency plan

Either internally or through an external provider, institute a backup plan for data, disaster recovery and emergencies.

3. Protect data from internal and external threats

Be sure to have a strong security plan in place to protect data from all threats. Limit access to company data to only those who need it. “Physical safeguards need to be implemented to secure the facility, like access controls for the facility,” Parann-Nissany added.

4. Implement technical safeguards

Have a plan in place to ensure proper transmission, storage and deletion of data. Be sure to monitor and control access. “Adopt strong encryption technology and develop a plan to ensure data is transmitted, stored, and deleted securely,” he said.

5. Put HIPAA Administrative Safeguards in place

With the help of a privacy officer, develop and implement an internal HIPAA compliance plan. “Ensure that policies and procedures deal with analysis of risk, management of risk, policy violations, and sanctions for staff or contractors in violation of the policy,” Parann-Nissany suggests.